deps(backend): bump expr and mapstructure/v2 for reachable advisories

[Portll]

What

backend/go.mod: github.com/expr-lang/expr 1.17.0 → 1.17.7 and github.com/go-viper/mapstructure/v2 2.2.1 → 2.3.0, with go mod tidy.

Why

govulncheck traces a call path from this backend to the vulnerable symbols in both, so these are reachable rather than merely present:

• GO-2025-4245 (expr): denial of service via unbounded recursion in a builtin function. Fixed in 1.17.7.
• GO-2025-3787 (mapstructure): may leak sensitive information in logs when decoding malformed data. Fixed in 2.3.0.

Both are patch-level bumps within the same major.

Not in this PR

govulncheck also reports reachable advisories in github.com/ollama/ollama 0.10.1 (eight, GO-2025-3557 through GO-2025-4251) and github.com/golang-jwt/jwt v3 (GO-2025-3553, no fix on the v3 line). The ollama bump is a larger version jump and jwt needs a move to jwt/v5, so each deserves its own review. Happy to open them if wanted.

Verification

go build ./... on macOS arm64 with the bumped modules compiles everything except modules/data/domain/component/vfs, which fails identically on the untouched go.mod (dc.UseInt64 undefined on sonic's StreamDecoder, a platform build-tag difference), so that is unrelated. Tests were not run here; CI is the first full run.

Found by commitwork.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}